DMARC alignment explained
Alignment is the single most important concept in DMARC — and the one most often skipped. If you understand alignment, DMARC reports stop being cryptic: every pass, every fail and every strange-looking row suddenly has an explanation.
Here is the short version: it is not enough for SPF or DKIM to pass. The domain they passed for must match the domain in the visible From address. That match is called alignment, and it is the whole reason DMARC exists.
Why passing SPF or DKIM is not enough
Both of the underlying checks validate a domain your reader never sees.
SPF checks the envelope-from — the hidden bounce address used during the SMTP conversation. DKIM checks the d= domain in the signature — whichever domain published the signing key. Neither standard requires those domains to have anything to do with the From address displayed in the mail client.
A phisher exploits this directly: they send from their own server, use attacker-domain.example in the envelope-from (their own SPF passes), sign with d=attacker-domain.example (their own DKIM passes) — and put From: [email protected] on display. Both checks pass. The reader is deceived anyway.
Alignment closes this hole by adding one requirement: the domain that passed must match the From domain the human sees.
The rule that decides everything
For each incoming message, a DMARC-checking receiver asks two questions:
- Did SPF pass, and is the envelope-from domain aligned with the From domain?
- Did a DKIM signature verify, and is its
d=domain aligned with the From domain?
The rule in one sentence: a message passes DMARC if aligned SPF passes or aligned DKIM passes. Either one is enough — you never need both.
That "either one" rule is easy to gloss over and impossible to overstate. It is why DMARC is deployable in the real world at all: SPF and DKIM each have failure modes (forwarding breaks SPF; content-modifying lists break DKIM), but they rarely fail together for legitimate mail. One aligned pass carries the message.
Relaxed vs strict: the adkim and aspf tags
How exact does the match have to be? Your DMARC record can set the strictness separately for each check, with the adkim (DKIM) and aspf (SPF) tags. Both default to relaxed, written r.
Relaxed alignment requires the two domains to share the same organisational domain — the registrable part you actually own. mail.example.com, newsletters.example.com and example.com all share the organisational domain example.com, so any of them aligns with a From address at example.com.
Strict alignment (s) requires an exact, character-for-character domain match: mail.example.com no longer aligns with example.com.
Relaxed is the right choice for almost everyone — it is the default for a reason, and it is what lets providers sign or bounce via a subdomain of your domain without breaking anything. Strict is a hardening step for specific, well-understood setups, not a starting point.
Pass and fail combinations
Putting it all together — the raw result of each check, whether it aligned, and the DMARC verdict:
| SPF result | SPF aligned? | DKIM result | DKIM aligned? | DMARC verdict |
|---|---|---|---|---|
| pass | yes | pass | yes | pass |
| pass | yes | fail | — | pass |
| fail | — | pass | yes | pass |
| pass | no | pass | yes | pass |
| pass | no | fail | — | fail |
| fail | — | pass | no | fail |
| fail | — | fail | — | fail |
The pattern is clear once you see it: scan each row for at least one check that both passed and aligned. Nothing else matters — an unaligned pass counts for exactly as much as a fail.
The classic real-world case: your email provider
Here is the situation you will meet again and again in DMARC reports, and it confuses everyone the first time.
You send a newsletter through an email service provider. To handle bounces, the provider uses its own domain in the envelope-from — something like bounces.esp-example.net. SPF is evaluated against that domain, and it passes — the sending IP really is authorised by the provider's SPF record. But bounces.esp-example.net does not align with your From domain, so as far as DMARC is concerned, that SPF pass is worthless.
The message passes DMARC anyway — because when you set the provider up, you published the DNS records it gave you, and it signs every message with DKIM as d=yourdomain.com. Aligned DKIM pass. One is enough.
This is normal, healthy, and by design. It is also why a column of "SPF fail" or "SPF unaligned" next to a well-known provider in your reports is usually not a crisis: check the DKIM column first. If DKIM is passing and aligned, DMARC is passing, full stop. If neither check aligns for a provider you genuinely use, that is the thing to fix — usually by completing the provider's custom-domain DKIM setup.
Seeing alignment in your own traffic
Alignment is not something you configure once and forget; it is something you verify with data, sender by sender. Every aggregate report your domain receives states, for every source, whether SPF and DKIM passed and which domains they passed for — which is exactly the evidence you need before tightening your policy.
You can inspect your current DNS setup in seconds with the free domain checker, and see per-sender alignment verdicts on real traffic in the live demo — no account needed.